csaf_redhat - rhsa-2025:7242

rhsa-2025:7242

Vulnerability from csaf_redhat

Published

2025-05-13 08:36

Modified

2025-07-29 10:01

Summary

Red Hat Security Advisory: gstreamer1-plugins-good security update

Notes

Topic

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: OOB-read in qtdemux_parse_container (CVE-2024-47543) * gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk (CVE-2024-47774) * gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk (CVE-2024-47777) * gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk (CVE-2024-47778) * gstreamer1-plugins-good: OOB-read in parse_ds64 (CVE-2024-47775) * gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing (CVE-2024-47596) * gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (CVE-2024-47599) * gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate (CVE-2024-47834) * gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk (CVE-2024-47776) * gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling (CVE-2024-47544) * gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47601) * gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples (CVE-2024-47597) * gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read (CVE-2024-47546) * gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (CVE-2024-47602) * gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table (CVE-2024-47598) * gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47603) * gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read (CVE-2024-47545) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.\n\nSecurity Fix(es):\n\n* gstreamer1-plugins-good: OOB-read in qtdemux_parse_container (CVE-2024-47543)\n\n* gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk (CVE-2024-47774)\n\n* gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk (CVE-2024-47777)\n\n* gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk (CVE-2024-47778)\n\n* gstreamer1-plugins-good: OOB-read in parse_ds64 (CVE-2024-47775)\n\n* gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing (CVE-2024-47596)\n\n* gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences (CVE-2024-47599)\n\n* gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate (CVE-2024-47834)\n\n* gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk (CVE-2024-47776)\n\n* gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling (CVE-2024-47544)\n\n* gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47601)\n\n* gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples (CVE-2024-47597)\n\n* gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read (CVE-2024-47546)\n\n* gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer (CVE-2024-47602)\n\n* gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table (CVE-2024-47598)\n\n* gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer (CVE-2024-47603)\n\n* gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read (CVE-2024-47545)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:7242",
        "url": "https://access.redhat.com/errata/RHSA-2025:7242"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2331723",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331723"
      },
      {
        "category": "external",
        "summary": "2331739",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331739"
      },
      {
        "category": "external",
        "summary": "2331741",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331741"
      },
      {
        "category": "external",
        "summary": "2331743",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331743"
      },
      {
        "category": "external",
        "summary": "2331744",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331744"
      },
      {
        "category": "external",
        "summary": "2331747",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331747"
      },
      {
        "category": "external",
        "summary": "2331748",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331748"
      },
      {
        "category": "external",
        "summary": "2331749",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331749"
      },
      {
        "category": "external",
        "summary": "2331750",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331750"
      },
      {
        "category": "external",
        "summary": "2331751",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331751"
      },
      {
        "category": "external",
        "summary": "2331752",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331752"
      },
      {
        "category": "external",
        "summary": "2331755",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331755"
      },
      {
        "category": "external",
        "summary": "2331756",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331756"
      },
      {
        "category": "external",
        "summary": "2331759",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331759"
      },
      {
        "category": "external",
        "summary": "2331761",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331761"
      },
      {
        "category": "external",
        "summary": "2331762",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331762"
      },
      {
        "category": "external",
        "summary": "2331763",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331763"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7242.json"
      }
    ],
    "title": "Red Hat Security Advisory: gstreamer1-plugins-good security update",
    "tracking": {
      "current_release_date": "2025-07-29T10:01:38+00:00",
      "generator": {
        "date": "2025-07-29T10:01:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.5"
        }
      },
      "id": "RHSA-2025:7242",
      "initial_release_date": "2025-05-13T08:36:31+00:00",
      "revision_history": [
        {
          "date": "2025-05-13T08:36:31+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-05-13T08:36:31+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-07-29T10:01:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.6.0.GA",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.src",
                "product": {
                  "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.src",
                  "product_id": "gstreamer1-plugins-good-0:1.22.12-4.el9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.22.12-4.el9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
                "product": {
                  "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
                  "product_id": "gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.22.12-4.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
                  "product_id": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.22.12-4.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
                "product": {
                  "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
                  "product_id": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.22.12-4.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
                "product": {
                  "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
                  "product_id": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.22.12-4.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
                  "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.22.12-4.el9?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
                "product": {
                  "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
                  "product_id": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-qt-debuginfo@1.22.12-4.el9?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
                "product": {
                  "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
                  "product_id": "gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.22.12-4.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
                  "product_id": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.22.12-4.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
                "product": {
                  "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
                  "product_id": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.22.12-4.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
                "product": {
                  "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
                  "product_id": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.22.12-4.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
                  "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.22.12-4.el9?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
                "product": {
                  "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
                  "product_id": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-qt-debuginfo@1.22.12-4.el9?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
                "product": {
                  "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
                  "product_id": "gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.22.12-4.el9?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
                  "product_id": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.22.12-4.el9?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
                "product": {
                  "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
                  "product_id": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.22.12-4.el9?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
                "product": {
                  "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
                  "product_id": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.22.12-4.el9?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
                  "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.22.12-4.el9?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
                "product": {
                  "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
                  "product_id": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-qt-debuginfo@1.22.12-4.el9?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
                "product": {
                  "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
                  "product_id": "gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.22.12-4.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
                  "product_id": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.22.12-4.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
                "product": {
                  "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
                  "product_id": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.22.12-4.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
                "product": {
                  "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
                  "product_id": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.22.12-4.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
                  "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.22.12-4.el9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64",
                "product": {
                  "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64",
                  "product_id": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-qt-debuginfo@1.22.12-4.el9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
                "product": {
                  "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
                  "product_id": "gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good@1.22.12-4.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
                  "product_id": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk@1.22.12-4.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
                "product": {
                  "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
                  "product_id": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debugsource@1.22.12-4.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
                "product": {
                  "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
                  "product_id": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-debuginfo@1.22.12-4.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
                "product": {
                  "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
                  "product_id": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-gtk-debuginfo@1.22.12-4.el9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
                "product": {
                  "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
                  "product_id": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/gstreamer1-plugins-good-qt-debuginfo@1.22.12-4.el9?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64"
        },
        "product_reference": "gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686"
        },
        "product_reference": "gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le"
        },
        "product_reference": "gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x"
        },
        "product_reference": "gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src"
        },
        "product_reference": "gstreamer1-plugins-good-0:1.22.12-4.el9.src",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64"
        },
        "product_reference": "gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64"
        },
        "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686"
        },
        "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le"
        },
        "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x"
        },
        "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64"
        },
        "product_reference": "gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64"
        },
        "product_reference": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686"
        },
        "product_reference": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le"
        },
        "product_reference": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x"
        },
        "product_reference": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64"
        },
        "product_reference": "gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64"
        },
        "product_reference": "gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64"
        },
        "product_reference": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686"
        },
        "product_reference": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le"
        },
        "product_reference": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x"
        },
        "product_reference": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        },
        "product_reference": "gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64",
        "relates_to_product_reference": "AppStream-9.6.0.GA"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-47543",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-12-11T19:01:06.518071+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331723"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. An out-of-bounds read in the MP4/MOV demuxer can lead to crashes for certain input files, potentially allowing a malicious third party to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: OOB-read in qtdemux_parse_container",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47543"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331723",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331723"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47543",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47543"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47543",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47543"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0009.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0009.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-236_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-236_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T18:55:50.210000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: OOB-read in qtdemux_parse_container"
    },
    {
      "cve": "CVE-2024-47544",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2024-12-11T20:01:47.895968+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331751"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. Multiple NULL pointer dereferences in the MP4/MOV demuxer\u0027s CENC handling can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47544"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331751",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331751"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47544",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47544"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47544",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47544"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0011.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0011.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T18:57:31.268000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: NULL-pointer dereferences in MP4/MOV demuxer CENC handling"
    },
    {
      "cve": "CVE-2024-47545",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "discovery_date": "2024-12-11T20:02:36.295237+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331763"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. An integer overflow in the MP4/MOV demuxer can lead to out-of-bounds reads that may cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47545"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331763",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331763"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47545",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47545"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47545",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47545"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0010.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0010.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T18:58:14.462000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: integer underflow in FOURCC_strf parsing leading to OOB-read"
    },
    {
      "cve": "CVE-2024-47546",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "discovery_date": "2024-12-11T20:02:09.371312+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. Integer underflow in the MP4/MOV demuxer can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47546"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47546"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0013.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0013.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-243_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-243_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:01:05.831000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: integer underflow in extract_cc_from_data leading to OOB-read"
    },
    {
      "cve": "CVE-2024-47596",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-12-11T20:01:30.387932+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. An integer underflow due to missing size checks in the MP4/MOV demuxer can lead to out-of-bounds reads and cause crashes for certain input files. This issue can allow a malicious actor to trigger a crash of the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47596"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47596",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47596"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47596",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47596"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0015.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0015.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-244_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-244_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:01:23.353000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: OOB-read in FOURCC_SMI_ parsing"
    },
    {
      "cve": "CVE-2024-47597",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-12-11T20:02:05.307914+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331755"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. Multiple out-of-bounds reads in the MP4/MOV demuxer\u0027s sample table parsing and a lack of error checking can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47597"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331755",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331755"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47597",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47597"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47597",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47597"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0012.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0012.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-245_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-245_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:01:50.820000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: OOB-read in qtdemux_parse_samples"
    },
    {
      "cve": "CVE-2024-47598",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-12-11T20:02:28.768219+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331761"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. When handling raw audio tracks, out-of-bounds reads in the MP4/MOV demuxer\u0027s sample table parser can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47598"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331761",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331761"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47598",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47598"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47598",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47598"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0006.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0006.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-246_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-246_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:02:32.029000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: OOB-read in qtdemux_merge_sample_table"
    },
    {
      "cve": "CVE-2024-47599",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2024-12-11T20:01:34.696203+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331748"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. Insufficient error handling in the JPEG decoder can lead to NULL-pointer dereferences and cause crashes for certain input files, making it possible for a malicious actor to trigger a crash of the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47599"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331748",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331748"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47599",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47599"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47599",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47599"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8040.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8040.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0016.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0016.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-247_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-247_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:02:52.412000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences"
    },
    {
      "cve": "CVE-2024-47601",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2024-12-11T20:01:52.496087+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331752"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. A NULL pointer dereference in the Matroska/WebM demuxer can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47601"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331752",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331752"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47601",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47601"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47601",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47601"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0020.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0020.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-249_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-249_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:03:36.650000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer"
    },
    {
      "cve": "CVE-2024-47602",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2024-12-11T20:02:21.573425+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331759"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. NULL pointer dereferences and out-of-bounds reads in the Matroska/WebM demuxer can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47602"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331759",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331759"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47602",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47602"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47602",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47602"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0019.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0019.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:10:31.683000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer"
    },
    {
      "cve": "CVE-2024-47603",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2024-12-11T20:02:32.664783+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. A NULL pointer dereference in the Matroska/WebM demuxer can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47603"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47603",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47603"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47603",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47603"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0021.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0021.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-251_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-251_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:11:51.382000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: NULL-pointer dereference in Matroska/WebM demuxer"
    },
    {
      "cve": "CVE-2024-47774",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-12-11T20:00:59.225323+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331739"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. An out-of-bounds read in the gst_avi_subtitle_parse_gab2_chunk function can cause crashes for certain input files, potentially allowing a malicious third party to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47774"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331739",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331739"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47774",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47774"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47774",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47774"
        },
        {
          "category": "external",
          "summary": "https://github.com/github/securitylab-vulnerabilities/issues/1826",
          "url": "https://github.com/github/securitylab-vulnerabilities/issues/1826"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8043.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8043.patch"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-262_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-262_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:15:18.259000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk"
    },
    {
      "cve": "CVE-2024-47775",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-12-11T20:01:18.849608+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331744"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. Various out-of-bounds reads in the WAV parser can cause crashes for certain input files, making it possible for a malicious actor to trigger a crash of the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: OOB-read in parse_ds64",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47775"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331744",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331744"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47775",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47775"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47775",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47775"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-261_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-261_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:15:44.607000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: OOB-read in parse_ds64"
    },
    {
      "cve": "CVE-2024-47776",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-12-11T20:01:43.508443+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331750"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. Various out-of-bounds reads in the WAV parser can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47776"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331750",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331750"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47776",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47776"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47776",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47776"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-260_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-260_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:16:04.573000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: OOB-read in gst_wavparse_cue_chunk"
    },
    {
      "cve": "CVE-2024-47777",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-12-11T20:01:07.868488+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331741"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. Various out-of-bounds reads in the WAV parser can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47777"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331741",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331741"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47777",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47777"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47777",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47777"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-259_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-259_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:16:33.169000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: OOB-read in gst_wavparse_smpl_chunk"
    },
    {
      "cve": "CVE-2024-47778",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2024-12-11T20:01:15.497737+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331743"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. Various out-of-bounds reads in the WAV parser can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47778"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331743",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331743"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47778",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47778"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47778",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47778"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-258_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-258_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:16:58.215000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: OOB-read in gst_wavparse_adtl_chunk"
    },
    {
      "cve": "CVE-2024-47834",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2024-12-11T20:01:39.432741+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331749"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the GStreamer library. A use-after-free in the Matroska demuxer can cause crashes for certain input files, potentially allowing a malicious actor to trigger an application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
          "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-47834"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331749",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331749"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-47834",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-47834"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-47834",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47834"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "category": "external",
          "summary": "https://gstreamer.freedesktop.org/security/sa-2024-0030.html",
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0030.html"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2024-280_Gstreamer/",
          "url": "https://securitylab.github.com/advisories/GHSL-2024-280_Gstreamer/"
        }
      ],
      "release_date": "2024-12-11T19:18:04.069000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-05-13T08:36:31+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:7242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.src",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-debugsource-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-gtk-debuginfo-0:1.22.12-4.el9.x86_64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.aarch64",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.i686",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.ppc64le",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.s390x",
            "AppStream-9.6.0.GA:gstreamer1-plugins-good-qt-debuginfo-0:1.22.12-4.el9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "gstreamer1-plugins-good: Use-After-Free read in Matroska CodecPrivate"
    }
  ]
}

CVE-2024-47546 (GCVE-0-2024-47546)

Vulnerability from cvelistv5

Published

2024-12-11 19:01

Modified

2024-12-13 17:42

Severity ?

6.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

Summary

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction atom_length - 8 may result in an underflow if atom_length is less than 8. When that subtraction underflows, *cclen ends up being a large number, and then cclen is passed to g_memdup2 leading to an out-of-bounds (OOB) read. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-243_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0013.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47546",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-13T17:42:31.315152Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-13T17:42:41.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction atom_length - 8 may result in an underflow if atom_length is less than 8. When that subtraction underflows, *cclen ends up being a large number, and then cclen is passed to g_memdup2 leading to an out-of-bounds (OOB) read. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:01:05.831Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-243_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-243_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0013.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0013.html"
        }
      ],
      "source": {
        "advisory": "GHSA-8mrc-f6w6-gpph",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-243: GStreamer has an integer underflow in extract_cc_from_data leading to OOB-read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47546",
    "datePublished": "2024-12-11T19:01:05.831Z",
    "dateReserved": "2024-09-25T21:46:10.931Z",
    "dateUpdated": "2024-12-13T17:42:41.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47603 (GCVE-0-2024-47603)

Vulnerability from cvelistv5

Published

2024-12-11 19:11

Modified

2024-12-11 20:42

Severity ?

6.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-476 - NULL Pointer Dereference

Summary

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_update_tracks function within matroska-demux.c. The vulnerability occurs when the gst_caps_is_equal function is called with invalid caps values. If this happen, then in the function gst_buffer_get_size the call to GST_BUFFER_MEM_PTR can return a null pointer. Attempting to dereference the size field of this null pointer results in a null pointer dereference. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-251_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0021.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47603",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T20:38:14.418203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T20:42:29.146Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_update_tracks function within matroska-demux.c. The vulnerability occurs when the gst_caps_is_equal function is called with invalid caps values. If this happen, then in the function gst_buffer_get_size the call to GST_BUFFER_MEM_PTR can return a null pointer. Attempting to dereference the size field of this null pointer results in a null pointer dereference. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:11:51.382Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-251_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-251_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0021.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0021.html"
        }
      ],
      "source": {
        "advisory": "GHSA-gqcc-q947-jv78",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47603",
    "datePublished": "2024-12-11T19:11:51.382Z",
    "dateReserved": "2024-09-27T20:37:22.119Z",
    "dateUpdated": "2024-12-11T20:42:29.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47777 (GCVE-0-2024-47777)

Vulnerability from cvelistv5

Published

2024-12-11 19:16

Modified

2024-12-11 21:07

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without checking if the size of the data buffer is sufficient. If the buffer is too small, the function reads beyond its bounds. This vulnerability may result in reading 4 bytes out of the boundaries of the data buffer. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-259_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0027.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47777",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T21:07:19.494550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T21:07:34.497Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without checking if the size of the data buffer is sufficient. If the buffer is too small, the function reads beyond its bounds. This vulnerability may result in reading 4 bytes out of the boundaries of the data buffer. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:16:33.169Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-259_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-259_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html"
        }
      ],
      "source": {
        "advisory": "GHSA-p29q-wv55-9qfv",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47777",
    "datePublished": "2024-12-11T19:16:33.169Z",
    "dateReserved": "2024-09-30T21:28:53.235Z",
    "dateUpdated": "2024-12-11T21:07:34.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47776 (GCVE-0-2024-47776)

Vulnerability from cvelistv5

Published

2024-12-11 19:16

Modified

2024-12-11 21:06

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value provided to the function. This mismatch causes the comparison if (size < 4 + ncues * 24) to fail in some cases, allowing the subsequent loop to access beyond the bounds of the data buffer. The root cause of this discrepancy stems from a miscalculation when clipping the chunk size based on upstream data size. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-260_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0027.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47776",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T21:06:46.744890Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T21:06:56.613Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value provided to the function. This mismatch causes the comparison  if (size \u003c 4 + ncues * 24) to fail in some cases, allowing the subsequent loop to access beyond the bounds of the data buffer. The root cause of this discrepancy stems from a miscalculation when clipping the chunk size based on upstream data size. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:16:04.573Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-260_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-260_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html"
        }
      ],
      "source": {
        "advisory": "GHSA-qw5m-vfj2-xrx9",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47776",
    "datePublished": "2024-12-11T19:16:04.573Z",
    "dateReserved": "2024-09-30T21:28:53.234Z",
    "dateUpdated": "2024-12-11T21:06:56.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47543 (GCVE-0-2024-47543)

Vulnerability from cvelistv5

Published

2024-12-11 18:55

Modified

2024-12-12 14:30

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function qtdemux_parse_node, the value of length is not well checked. So, if length is big enough, it causes the pointer end to point beyond the boundaries of buffer. Subsequently, in the qtdemux_parse_container function, the while loop can trigger an OOB-read, accessing memory beyond the bounds of buf. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-236_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0009.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47543",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T14:29:43.230153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T14:30:04.325Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function qtdemux_parse_node, the value of length is not well checked. So, if length is big enough, it causes the pointer end to point beyond the boundaries of buffer. Subsequently, in the qtdemux_parse_container function, the while loop can trigger an OOB-read, accessing memory beyond the bounds of buf. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T18:55:50.210Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-236_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-236_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0009.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0009.html"
        }
      ],
      "source": {
        "advisory": "GHSA-f4cr-4qmv-5fh6",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-236: GStreamer has an OOB-read in qtdemux_parse_container"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47543",
    "datePublished": "2024-12-11T18:55:50.210Z",
    "dateReserved": "2024-09-25T21:46:10.931Z",
    "dateUpdated": "2024-12-12T14:30:04.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47597 (GCVE-0-2024-47597)

Vulnerability from cvelistv5

Published

2024-12-11 19:01

Modified

2024-12-11 21:51

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream->stco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-245_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0012.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47597",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T21:50:51.754656Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T21:51:28.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream-\u003estco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:01:50.820Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-245_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-245_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0012.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0012.html"
        }
      ],
      "source": {
        "advisory": "GHSA-22m6-44pv-4cgj",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47597",
    "datePublished": "2024-12-11T19:01:50.820Z",
    "dateReserved": "2024-09-27T20:37:22.118Z",
    "dateUpdated": "2024-12-11T21:51:28.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47601 (GCVE-0-2024-47601)

Vulnerability from cvelistv5

Published

2024-12-11 19:03

Modified

2024-12-12 14:26

Severity ?

6.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-476 - NULL Pointer Dereference

Summary

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not properly check the validity of the GstBuffer *sub pointer before performing dereferences. As a result, null pointer dereferences may occur. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-249_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0020.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47601",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T14:25:58.727068Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T14:26:05.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not properly check the validity of the GstBuffer *sub pointer before performing dereferences. As a result, null pointer dereferences may occur. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:03:36.650Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-249_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-249_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0020.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0020.html"
        }
      ],
      "source": {
        "advisory": "GHSA-fgw2-8jw2-ph33",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47601",
    "datePublished": "2024-12-11T19:03:36.650Z",
    "dateReserved": "2024-09-27T20:37:22.119Z",
    "dateUpdated": "2024-12-12T14:26:05.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47544 (GCVE-0-2024-47544)

Vulnerability from cvelistv5

Published

2024-12-11 18:57

Modified

2024-12-12 16:37

Severity ?

6.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-476 - NULL Pointer Dereference

Summary

GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0011.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47544",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T16:37:30.341361Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T16:37:40.731Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T18:57:31.268Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0011.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0011.html"
        }
      ],
      "source": {
        "advisory": "GHSA-p9cf-r365-qh32",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47544",
    "datePublished": "2024-12-11T18:57:31.268Z",
    "dateReserved": "2024-09-25T21:46:10.931Z",
    "dateUpdated": "2024-12-12T16:37:40.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47774 (GCVE-0-2024-47774)

Vulnerability from cvelistv5

Published

2024-12-11 19:15

Modified

2024-12-12 14:15

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function reads the name_length value directly from the input file without checking it properly. Then, the a condition, does not properly handle cases where name_length is greater than 0xFFFFFFFF - 17, causing an integer overflow. In such scenario, the function attempts to access memory beyond the buffer leading to an OOB-read. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-262_Gstreamer/	x_refsource_CONFIRM
	https://github.com/github/securitylab-vulnerabilities/issues/1826	x_refsource_MISC
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8043.patch	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T14:15:00.272216Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T14:15:07.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function reads the name_length value directly from the input file without checking it properly. Then, the a condition, does not properly handle cases where name_length is greater than 0xFFFFFFFF - 17, causing an integer overflow. In such scenario, the function attempts to access memory beyond the buffer leading to an OOB-read. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:15:18.259Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-262_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-262_Gstreamer/"
        },
        {
          "name": "https://github.com/github/securitylab-vulnerabilities/issues/1826",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/github/securitylab-vulnerabilities/issues/1826"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8043.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8043.patch"
        }
      ],
      "source": {
        "advisory": "GHSA-qjr8-gwp5-24w7",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47774",
    "datePublished": "2024-12-11T19:15:18.259Z",
    "dateReserved": "2024-09-30T21:28:53.234Z",
    "dateUpdated": "2024-12-12T14:15:07.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47775 (GCVE-0-2024-47775)

Vulnerability from cvelistv5

Published

2024-12-11 19:15

Modified

2024-12-11 21:06

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 function within gstwavparse.c. The parse_ds64 function does not check that the buffer buf contains sufficient data before attempting to read from it, doing multiple GST_READ_UINT32_LE operations without performing boundary checks. This can lead to an OOB-read when buf is smaller than expected. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-261_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0027.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47775",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T21:06:26.150191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T21:06:33.799Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 function within gstwavparse.c. The parse_ds64 function does not check that the buffer buf contains sufficient data before attempting to read from it, doing multiple GST_READ_UINT32_LE operations without performing boundary checks. This can lead to an OOB-read when buf is smaller than expected. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:15:44.607Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-261_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-261_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html"
        }
      ],
      "source": {
        "advisory": "GHSA-hxxw-2g39-jv2p",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-261: GStreamer has an OOB-read in parse_ds64"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47775",
    "datePublished": "2024-12-11T19:15:44.607Z",
    "dateReserved": "2024-09-30T21:28:53.234Z",
    "dateUpdated": "2024-12-11T21:06:33.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47778 (GCVE-0-2024-47778)

Vulnerability from cvelistv5

Published

2024-12-11 19:16

Modified

2024-12-11 21:12

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to insufficient validation of the size parameter, which can exceed the bounds of the data buffer. As a result, an OOB read occurs in the following while loop. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-258_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0027.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47778",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T21:12:16.776786Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T21:12:34.879Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to insufficient validation of the size parameter, which can exceed the bounds of the data buffer. As a result, an OOB read occurs in the following while loop. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:16:58.215Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-258_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-258_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0027.html"
        }
      ],
      "source": {
        "advisory": "GHSA-g5r2-cgcp-4228",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47778",
    "datePublished": "2024-12-11T19:16:58.215Z",
    "dateReserved": "2024-09-30T21:28:53.235Z",
    "dateUpdated": "2024-12-11T21:12:34.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47834 (GCVE-0-2024-47834)

Vulnerability from cvelistv5

Published

2024-12-11 19:18

Modified

2024-12-11 21:15

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-416 - Use After Free

Summary

GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gst_matroska_demux_parse_stream function, a data chunk is allocated using gst_ebml_read_binary. Later, the allocated memory is freed in the gst_matroska_track_free function, by the call to g_free (track->codec_priv). Finally, the freed memory is accessed in the caps_serialize function through gst_value_serialize_buffer. The freed memory will be accessed in the gst_value_serialize_buffer function. This results in a UAF read vulnerability, as the function tries to process memory that has already been freed. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-280_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0030.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47834",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T21:15:13.370606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T21:15:31.525Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gst_matroska_demux_parse_stream function, a data chunk is allocated using gst_ebml_read_binary. Later, the allocated memory is freed in the gst_matroska_track_free function, by the call to g_free (track-\u003ecodec_priv). Finally, the freed memory is accessed in the caps_serialize function through gst_value_serialize_buffer. The freed memory will be accessed in the gst_value_serialize_buffer function. This results in a UAF read vulnerability, as the function tries to process memory that has already been freed. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:18:04.069Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-280_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-280_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0030.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0030.html"
        }
      ],
      "source": {
        "advisory": "GHSA-35x4-mx8h-fgm8",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47834",
    "datePublished": "2024-12-11T19:18:04.069Z",
    "dateReserved": "2024-10-03T14:06:12.643Z",
    "dateUpdated": "2024-12-11T21:15:31.525Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47602 (GCVE-0-2024-47602)

Vulnerability from cvelistv5

Published

2024-12-11 19:10

Modified

2024-12-12 14:24

Severity ?

6.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-476 - NULL Pointer Dereference
CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the validity of the stream->codec_priv pointer in the following code. If stream->codec_priv is NULL, the call to GST_READ_UINT16_LE will attempt to dereference a null pointer, leading to a crash of the application. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0019.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47602",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T14:24:18.356233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T14:24:27.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the validity of the stream-\u003ecodec_priv pointer in the following code. If stream-\u003ecodec_priv is NULL, the call to GST_READ_UINT16_LE will attempt to dereference a null pointer, leading to a crash of the application. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:10:31.683Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0019.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0019.html"
        }
      ],
      "source": {
        "advisory": "GHSA-m48f-764w-83c6",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-250: Streamer NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47602",
    "datePublished": "2024-12-11T19:10:31.683Z",
    "dateReserved": "2024-09-27T20:37:22.119Z",
    "dateUpdated": "2024-12-12T14:24:27.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47596 (GCVE-0-2024-47596)

Vulnerability from cvelistv5

Published

2024-12-11 19:01

Modified

2024-12-13 17:42

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. In the FOURCC_SMI_ case, seqh_size is read from the input file without proper validation. If seqh_size is greater than the remaining size of the data buffer, it can lead to an OOB-read in the following call to gst_buffer_fill, which internally uses memcpy. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-244_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0015.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47596",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-13T17:41:58.125719Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-13T17:42:14.846Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. In the FOURCC_SMI_ case, seqh_size is read from the input file without proper validation. If seqh_size is greater than the remaining size of the data buffer, it can lead to an OOB-read in the following call to gst_buffer_fill, which internally uses memcpy. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:01:23.353Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-244_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-244_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0015.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0015.html"
        }
      ],
      "source": {
        "advisory": "GHSA-g338-pff2-5x8w",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-244: GStreamer has an OOB-read in FOURCC_SMI_ parsing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47596",
    "datePublished": "2024-12-11T19:01:23.353Z",
    "dateReserved": "2024-09-27T20:37:22.118Z",
    "dateUpdated": "2024-12-13T17:42:14.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47599 (GCVE-0-2024-47599)

Vulnerability from cvelistv5

Published

2024-12-11 19:02

Modified

2024-12-11 21:38

Severity ?

6.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-476 - NULL Pointer Dereference

Summary

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_video_decoder_set_output_state. When this happens, dereferences of the outstate pointer will lead to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-247_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8040.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0016.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47599",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T21:37:52.517866Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T21:38:01.666Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_video_decoder_set_output_state. When this happens, dereferences of the outstate pointer will lead to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:02:52.412Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-247_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-247_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8040.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8040.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0016.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0016.html"
        }
      ],
      "source": {
        "advisory": "GHSA-p5ff-v9j8-327r",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47599",
    "datePublished": "2024-12-11T19:02:52.412Z",
    "dateReserved": "2024-09-27T20:37:22.118Z",
    "dateUpdated": "2024-12-11T21:38:01.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47545 (GCVE-0-2024-47545)

Vulnerability from cvelistv5

Published

2024-12-11 18:58

Modified

2024-12-13 17:44

Severity ?

6.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

Summary

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0010.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47545",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-13T17:44:03.153452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-13T17:44:20.236Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak function within qtdemux.c. During the strf parsing case, the subtraction size -= 40 can lead to a negative integer overflow if it is less than 40. If this happens, the subsequent call to gst_buffer_fill will invoke memcpy with a large tocopy size, resulting in an OOB-read. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T18:58:14.462Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-242_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0010.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0010.html"
        }
      ],
      "source": {
        "advisory": "GHSA-gfcr-8wm5-vq57",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47545",
    "datePublished": "2024-12-11T18:58:14.462Z",
    "dateReserved": "2024-09-25T21:46:10.931Z",
    "dateUpdated": "2024-12-13T17:44:20.236Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-47598 (GCVE-0-2024-47598)

Vulnerability from cvelistv5

Published

2024-12-11 19:02

Modified

2024-12-11 21:42

Severity ?

5.1 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-125 - Out-of-bounds Read

Summary

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isn’t properly checked before reading stts_duration, allowing the program to read 4 bytes beyond the boundaries of stts->data. This vulnerability reads up to 4 bytes past the allocated bounds of the stts array. This vulnerability is fixed in 1.24.10.

References

►

URL

Tags

	https://securitylab.github.com/advisories/GHSL-2024-246_Gstreamer/	x_refsource_CONFIRM
	https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch	x_refsource_MISC
	https://gstreamer.freedesktop.org/security/sa-2024-0006.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gstreamer	gstreamer	Version: < 1.24.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47598",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T21:40:02.710613Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T21:42:50.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gstreamer",
          "vendor": "gstreamer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isn\u2019t properly checked before reading stts_duration, allowing the program to read 4 bytes beyond the boundaries of stts-\u003edata. This vulnerability reads up to 4 bytes past the allocated bounds of the stts array. This vulnerability is fixed in 1.24.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T19:02:32.029Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://securitylab.github.com/advisories/GHSL-2024-246_Gstreamer/",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://securitylab.github.com/advisories/GHSL-2024-246_Gstreamer/"
        },
        {
          "name": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch"
        },
        {
          "name": "https://gstreamer.freedesktop.org/security/sa-2024-0006.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gstreamer.freedesktop.org/security/sa-2024-0006.html"
        }
      ],
      "source": {
        "advisory": "GHSA-xgf3-8jmm-49hf",
        "discovery": "UNKNOWN"
      },
      "title": "GHSL-2024-246: GStreamer has an OOB-read in qtdemux_merge_sample_table"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-47598",
    "datePublished": "2024-12-11T19:02:32.029Z",
    "dateReserved": "2024-09-27T20:37:22.118Z",
    "dateUpdated": "2024-12-11T21:42:50.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2025:7242

Vulnerability from csaf_redhat

CVE-2024-47546 (GCVE-0-2024-47546)

Vulnerability from cvelistv5

CVE-2024-47603 (GCVE-0-2024-47603)

Vulnerability from cvelistv5

CVE-2024-47777 (GCVE-0-2024-47777)

Vulnerability from cvelistv5

CVE-2024-47776 (GCVE-0-2024-47776)

Vulnerability from cvelistv5

CVE-2024-47543 (GCVE-0-2024-47543)

Vulnerability from cvelistv5

CVE-2024-47597 (GCVE-0-2024-47597)

Vulnerability from cvelistv5

CVE-2024-47601 (GCVE-0-2024-47601)

Vulnerability from cvelistv5

CVE-2024-47544 (GCVE-0-2024-47544)

Vulnerability from cvelistv5

CVE-2024-47774 (GCVE-0-2024-47774)

Vulnerability from cvelistv5

CVE-2024-47775 (GCVE-0-2024-47775)

Vulnerability from cvelistv5

CVE-2024-47778 (GCVE-0-2024-47778)

Vulnerability from cvelistv5

CVE-2024-47834 (GCVE-0-2024-47834)

Vulnerability from cvelistv5

CVE-2024-47602 (GCVE-0-2024-47602)

Vulnerability from cvelistv5

CVE-2024-47596 (GCVE-0-2024-47596)

Vulnerability from cvelistv5

CVE-2024-47599 (GCVE-0-2024-47599)

Vulnerability from cvelistv5

CVE-2024-47545 (GCVE-0-2024-47545)

Vulnerability from cvelistv5

CVE-2024-47598 (GCVE-0-2024-47598)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature